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DETAILED ACTION 
Response to Arguments 

1 . Applicant's arguments filed 1 3 October 2005 have been fully considered but they are not 
persuasive. 

2. Applicant's amendments overcame the rejection under 35 U.S.C. 112, second paragraph. 

3. Applicant argued the sen/er database engine compahng subsequently modified versions 
ofttie structured virus database to form a delta set of virus definition records, wherein the client 
database engine stores the delta virus definition records set into the structured virus database 
was not taught by Nachenberg in view of Serbinis. As shown in Nachenberg, column 7, lines 25- 
27, Nachenberg detected virus code in a computer system. The virus database needed to create 
a delta set of virus definition records in order to detect the virus code in a computer system. 
Creation of a delta set of virus definitions required comparing subsequently modified versions of 
the structured virus database to create definitions used in virus code detection. 

4. Applicant argued Serbinis's addition of a relational database to Nachenberg did not 
disclose a client database engine storing at least one updated virus definition record into the 
structured virus database indexed by the identifier and the at least one virus name for each virus 
definition record. Serbinis disclosed the use of a relational database. Applicant conceded that 
indexing of records was inherent to a relational database in the remarks of 13 October 2005, 
page 12, line 1. The documents indexed in Serbinis had various items of each object, including a 
version name and a version id. (Serbinis, column 8, lines 45-47) Applicant conceded that 
indexing was inherent, and Serbinis showed that an id and a name of an object were present in 
each object record. Serbinis conclusively taught that any portion of a record in any combination 
could be indexed in the relational database. Serbinis cleariy taught a client database engine 
storing at least one updated virus definition record into the structured virus database indexed by 
the identifier and the at least one virus name for each virus definition record. 
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5. Applicant argued Serbinis's addition did not teach a converter converting the virus 
definition records stored in the structured virus database into a virus data file comprising virus 
definition sets. Applicant conceded that Serbinis did teach the conversion of a document to a file 
format. Applicant did not specify the makeup of a virus data file comprising virus definition sets. 
Serbinis taught that such a document was included in a database (Serbinis, column 8, lines 12- 
62), and was treated as a virus definition record '\n the combination of Nachenberg and Serbinis. 
In this treatment, the virus definition records or document records were converted into a data file 
comprising virus definition sets (Serbinis, column 10, lines 43-50, a particular file format suitable 
for the Authorized Users), which in the combination of Nachenberg-Serbinis was a virus data file. 

6. Applicant argued binary data encoding instructions were not taught by Nachenberg. The 
antivirus program in Nachenberg, column 6, lines 15-58 was the binary data encoding instructions 
claimed by Applicant. 

7. Applicant argued names associated with the computer virus were not taught in the 
Nachenberg-Serbinis combination. The names were shown in Serbinis. See Serbinis, column 8, 
lines 45-57. 

8. Applicant argued a server database engine that builds the virus definition records into the 
structured virus database by generating the identifier for each virus definition record and 
populating each virus definition record with the virus definition sentence and the virus removal 
sentence for the computer virus was not taught by Nachenberg-Serbinis. The creation of a virus 
database was taught by the Nachenberg-Serbinis combination. Nachenberg, column 1, lines 39- 
45 showed that the virus removal sentence was present in the combination (identify particular 
virus strains for removal). The virus definition sentence was used to identify the virus strains. 
Serbinis taught creating a database from document records (previously established herein as 
virus definition records). The identifier generated for each record was automatically created as 
the primary key in the Serbinis database as each record was added to the database. 

9. Applicant argued the lack of converting each virus definition set in the virus data file into a 
virus definition record was not in Nachenberg-Serbinis. As previously presented herein, 
conversion of files was taught in Serbinis. Nachenberg applied to Serbinis treated the Serbinis 
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document objects as virus definition records. Said records were converted with the techniques of 
Serbinis. 

Claim Rejections - 35 USC § 103 

10. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 

rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject 
matter sought to be patented and the prior art are such that the subject matter as a whole 
would have been obvious at the time the invention was made to a person having ordinary 
skill in the art to which said subject matter pertains. Patentability shall not be negatived 
by the manner in which the invention was made. 

11. Claims 1-2, 4-11, and 13-20 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Nachenberg (U.S. Patent No. 6,357,008) in view of Serbinis et al. (U.S. Patent No. 
6,314,425). 

12. In regard to claim 1 , Nachenberg disclosed a structured virus database storing one or 
more virus definition records (column 1, lines 27-33, lines 42-45; this was in the background of 
the Nachenberg patent as being well known prior art); an identifier uniquely identifying a 
computer virus (column 1 , lines 27-33); at least one virus name associated with the computer 
virus (column 2, lines 43-45); a virus definition sentence comprising object code providing 
operations to detect the identified computer virus within a computer system (column 1 , lines 39- 
41 , "signature scanning"); a virus removal sentence comprising object code providing operations 
to clean the identified computer virus from the computer system (column 1 , lines 39-41 ; Particular 
virus strains can be identified for removal .); and a server database engine comparing 
subsequently modified versions of the structured virus database to form a delta set of virus 
definition records (column 7, lines 25-27), wherein the client database engine stores the delta 
virus definition records set into the structured virus database (column 1 , lines 27-33). 
Nachenberg further disclosed a server database engine building the virus definition records into 



Application/Control Number: 09/740,617 Page 5 

Art Unit: 2145 

the structured virus database by generating ttie identifier for each virus definition record and 
populating each virus definition record with the virus definition sentence and the virus removal 
sentence for the computer virus. This was part of the virus signature database systenn inherently 
taught in colunnn 1 , lines 39-45. 

13. Nachenberg taught use of a database. See Nachenberg, column 1, lines 40-45. 
Nachenberg failed to explicitly disclose the use of a client database engine to store records into a 
database indexed by identifiers and names. Nachenburg likewise did not teach converting 
records stored in a database into a data file. However, Serbinis taught the implementation of a 
relational database (column 6, lines 27-53) which allowed for indexing by identifiers (inherent to a 
relational database, also taught in Serbinis, column 8, lines 12-62) and conversion of records into 
another file format (column 10, lines 15-61). Therefore, because Nachenberg taught use of a 
database and Serbinis taught commonly known techniques in database operation such as record 
conversion and indexing of records by various means, it would have been obvious to one of 
ordinary skill in the art to combine the Nachenberg invention with the teachings of Serbinis in 
order to allow easier access to records in a virus database. 

14. In regard to claim 2, Nachenberg further disclosed a client anti-virus language decompiler 
converting each virus definition set in the virus data file into a virus definition record. Column 2, 
lines 18-25 of Nachenberg teaches the detection of new and unknown viruses. Column 1, lines 
39-45 of Nachenberg teaches the use of virus definitions in a signature database. In order for the 
virus definitions to enter the virus database, the limitations taught in claim 2 are inherent to the 
Nachenberg invention. 

15. In regard to claim 5, Nachenberg in view of Serbinis is applied as in claim 1 . Nachenberg 
further disclosed a server anti-virus language decompiler converting each virus definition set in 
the virus data file into a virus definition record. See rejection of claim 2. 

16. In regard to claim 6, Nachenberg in view of Serbinis is applied as in claim 1 . Nachenberg 
further disclosed the database engine accessing the virus definition records in the structured virus 
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database to perform at least one ofaddmg, removing, and replacing a virus definition record. 
Nachenberg teaches updating a virus signature database in colunnn 1, lines 44-45. 

17. In regard to claim 7, Nachenberg in view of Serbinis is applied as in claim 1 . Serbinis 
further taught compression and decompression of a file that is transferred. See Serbinis, column 
11, line 66 - column 12, line 7 and column 13, lines 46-49. 

1 8. In regard to claim 8, Nachenberg in view of Serbinis is applied as in claim 1 . Serbinis 
further taught encryption and decryption of a file that is transferred. See Serbinis, column 1 1 , line 
66 - column 12, line 7 and column 13, lines 46-49. 

1 9. In regard to claim 9, Nachenberg in view of Serbinis is applied as in claim 1 . The 
motivation to combine Nachenberg with Serbinis was the additional limitations of the Serbinis 
relational database as explained in the rejection of claim 1. 

20. Claim 1 0 meets the same limitations as claim 1 , and the rejection of claim 1 is applied 
against claim 10. 

21 . Claim 1 1 meets the same limitations as claim 2, and the rejection of claim 2 is applied 
against claim 11. 

22. Claim 14 meets the same limitations as claim 5, and the rejection of claim 5 is applied 
against claim 14. 

23. Claim 1 5 meets the same limitations as claim 6, and the rejection of claim 6 is applied 
against claim 15. 

24. Claim 16 meets the same limitations as claim 7, and the rejection of claim 7 is applied 
against claim 16. 

25. Claim 17 meets the same limitations as claim 8, and the rejection of claim 8 is applied 
against claim 17. 

26. Claim 1 8 meets the same limitations as claim 9, and the rejection of claim 9 is applied 
against claim 18. 

27. Claim 19 meets the same limitations as claim 10, and the rejection of claim 10 is applied 
against claim 19. 
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28. Claim 20 meets the same limitations of claim 1 , and the rejection of claim 1 is applied 
against claim 20. 

Conclusion 

29. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

30. Bates et al. U.S. Patent No. 6,785,732 

31. Kouznetsov U.S. Patent No. 6,029,256 

32. Olivier et al. U.S. Pub. No. 2005/0283837 



33. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as 
set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE MONTHS 
from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the 
mailing date of this final action and the advisory action is not mailed until after the end of the 
THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the 
date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be 
calculated from the mailing date of the advisory action. In no event, however, will the statutory 
period for reply expire later than SIX MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or eariier communications from the examiner 
should be directed to Jeffrey R. Swearingen whose telephone number is (571) 272-3921. The 
examiner can normally be reached on M-F 8:30-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Jason Cardone can be reached on 571-272-3933. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Infonmation Retrieval (PAIR) system. Status infomiation for published applications 
may be obtained from either Private PAIR or Public PAIR. Status infomnation for unpublished 
applications is available through Private PAIR only. For more infomiation about the PAIR system, 
see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 




Jason Cardone 
Supervisory Patent Examiner 
Art Unit 2145 



